Limitations & FAQ

Use these limits when you choose where to place checks and how to configure enforcement.

Limitations#

Input screening is not a guarantee#

No system reliably filters instruction hijacking at the input boundary, because a malicious instruction is indistinguishable from legitimate content there. INT-Input catches a large class of attacks, but the stronger guarantee comes from also screening the tool calls and outputs an agent produces, which is where a hijack becomes an action. Gate on all three.

Classifiers are probabilistic#

The classifiers judge intent and safety rather than match known-bad strings, which is what lets them generalize to novel attacks. It also means decisions are scored, not certain. You set thresholds that trade coverage against false positives. Lower thresholds catch more and flag more. Higher thresholds are quieter and let more through. There is no setting that is all coverage and no noise.

Not a perimeter or permission control#

Integrity does not replace network policy, service mesh, or least-privilege identity. If an agent reaches for a resource it is not authorized to touch, that is your access layer’s job. Integrity covers the authorized-channel case those controls cannot see. See the two planes. You need both layers.

INT-CoT is conjunction-only#

Chain-of-thought integrity (INT-CoT) is live as an experimental signal and is off by default in gateway policy. It cannot block independently. Material, rising divergence may escalate an already-flagged INT-Tooling or INT-Output result into the normal retry and block path. A clean reasoning trace is not proof of safe behavior, so gate observable actions with INT-Tooling and INT-Output.

Project threshold tuning is manual#

Observe-mode traces and score histograms help you choose project thresholds. Production does not fit those thresholds, consume reviewer labels, or retrain classifier weights from your traffic. See Thresholds and calibration.

Enforcement is a security-vs-availability choice#

Running inline has a failure mode. Fail-open preserves availability and accepts a coverage gap during an outage. Fail-closed preserves security and accepts that an outage can block legitimate work. Choose deliberately, per project, and tell whoever owns the request path.

Not a replacement for app-sec hygiene#

Dependency pinning, secrets management, and supply-chain controls remain yours. Integrity screens model and agent behavior at runtime. It does not secure the software underneath it.

Not a code, malware, dependency, or artifact scanner#

The production classifiers are trained for prompt, reasoning, tool-use, and output integrity. They do not parse or execute source code, resolve dependency vulnerabilities, inspect packages/binaries, detect malware, or prove that commands and build artifacts are non-malicious. Even when INT-Tooling receives a shell command or structured arguments, it evaluates behavioral intent, authorization, and context; it does not evaluate the implementation or payload as code. Never use an Integrity allow verdict as the sole gate for executing repository code, publishing a package, promoting an artifact, or deploying to production. Keep code review, malware/dependency/secret scanning, provenance, sandboxed validation, and deployment approval as separate controls.

Gateway enforcement is cooperative#

The gateway controls only traffic a client actually sends through its supported OpenAI or Anthropic endpoint. A client can bypass it by using another base URL, making a direct provider call, or acting through an out-of-band browser, shell, MCP server, or tool transport. Bind egress, credentials, and tool permissions independently when bypass resistance is required.

Protocol and modality coverage is explicit#

Supported ingress is /v1/chat/completions, /v1/responses, and /v1/messages. Current classifiers evaluate text projections, tool calls, and provider-exposed reasoning text. They do not inspect images, documents, audio, binaries, or hidden provider chain of thought. OpenAI INT-CoT uses reasoning summaries exposed by the Responses API; it does not recover private reasoning. Enforce rejects unsupported Anthropic user modalities and withholds unsupported tool-result blocks rather than pretending they were scanned.

Managed agents need an endpoint override#

Codex and Claude Code can use the gateway where their runtime allows the documented base-URL and credential configuration. ChatGPT and fully hosted Codex, Claude, or similar agents that do not expose a model-endpoint override have no transparent insertion seam. See Codex and Claude Code setup.

FAQ#

Do we have to rebuild our workflows?#

No. Either add SDK checks at the points you want to screen, or route existing OpenAI- or Anthropic-compatible traffic through the gateway with a one-line base_url change. Adoption is a configuration change, not a rewrite.

Does the model or provider matter?#

INT-Input, INT-Tooling, and INT-Output do not select thresholds by source model. INT-CoT is different: its static map first selects exact per-model calibration, then an explicitly declared family_proxy, and otherwise the global fallback. Family proxies are operational defaults and do not count as exact enforcement calibration. The gateway forwards requests to its configured OpenAI-compatible, Azure OpenAI, Anthropic, or Anthropic-compatible upstream. The hosted gateway does not translate Bedrock SigV4 or Vertex GCP OAuth credentials.

How do we get the signals out?#

Persisted checks and gateway decisions are visible in the dashboard’s Traces and Overview. For direct classifier calls, the verdict is also returned inline for you to log wherever you already send telemetry. Contact info@triage-sec.com for programmatic telemetry access.

Does Integrity train on our traffic?#

The production runtime does not use traces or security events to update classifier weights or project thresholds. Content mode controls what is retained, and the default telemetry retention window is 90 days. See Security and data handling for the runtime boundary and the contact path for contractual questions about offline data use.

How long until a project is calibrated?#

There is no automatic project-calibration state or wait period. Enabled classifiers run on the first eligible request. Start in Observe, collect representative score distributions, and change project thresholds manually before you enforce.

Will it slow down my app?#

Every enabled classifier adds work to the request path, and latency varies with input size, load, deployment, and cold starts. Measure representative traffic before setting an SLO. See Performance & latency for measurement guidance and tuning levers such as concurrency and enabling only the classifiers you need.